DrWatson Postmortem Debugger virus is ravaging my computer!! HELP ME!!

Question

hey everyone.
like several recent users have posted, i recently have gotten some vius where i cannot open up internet explorer, search, or control panel. when opened, all these crash with the typical message "Drwatson postmortem debugger has encountered a problem and will now close. we are sorry for the inconvenience." if anyone needs more detail, this link http://forums.us.dell.com/supportforums/board/message?board.id=si_virus&message.id=37452#M37452
should give u all the info u need, since its another user with the same problem as me.
now is this a problem that accompanied an SP2 installation? i checked with system restore, and SP2 apparently has not been installed. however, since this problem started only a couple of days ago, will performing a system restore get rid of this problem? im terrible at computers, so i would appreciate if someone helped me with this in idiot-proof language. thanks.

ky331 · Answer

there can be more than one cause for the dr. watson problem. in the OTHER thread that you referenced, the person there had a CoolWebSearch / About:Blank infection (reinforced by trojans) which was the underlying cause of his/her dr. watson problem. this MIGHT be your problem too, but not necessarily. as was done in the other thread, your best bet is to include a HiJackThis log, so that the experts here can made the proper determination:

Download the latest version of HJT(hijackthis) (version 1.99.1) from

http://majorgeeks.com/download3155.html

you must create a separate folder and place it there.... people commonly use C:\HJT. Note: Please do *NOT* use a TEMP (temporary) folder, *NOR* your DESKTOP, as HJT will be generating log files and backup files in the folder from which it is run... you risk accidentally losing these if you use a TEMP folder, and you will generate extreme clutter if you use your DESKTOP.

The file above comes as a compressed .ZIP file... you have to UNzip it (hopefully, you have an UNzip utility built into your Windows Explorer. If for any reason, you're unable to UNzip it, you can download the already-unzipped .EXE file from http://downloads.malwareremoval.com/HijackThis.exe )

After Unzipping, double click on HiJackThis.EXE

Click on Do a System Scan and Save a LogFile

This will automatically open NotePad

Copy the entire file from NotePad: EDIT/SelectAll, EDIT/Copy

Then go to the new forum dedicated for HiJack This logs (**NOT** back here), and PASTE the results there:

http://forums.us.dell.com/supportforums/board?board.id=si_hijack

Be sure to include a detailed description of any problems/errors/warnings you are encountering.

Hopefully, one of the HJT experts will get to it as quickly as possible.

WARNING: HiJack This is a VERY POWERFUL tool. Do *NOT* do anything else (in particular, do NOT use it to delete any entries) until you are advised to do so!! Improper use of this tool can severely damage your system.

Please note: The procedure as worded above has been carefully edited over time, so as to expedite the process of helping people. Nevertheless, it seems that many individuals try to be "creative", and make some variations. It really would be to your benefit if you follow these directions EXACTLY as stated... because certain changes on your part can result in slowing-down the help process.

Specifically, the following are 3 very common BAD deviations which will cause delays:

a) BAD: using an older/outdated version of HiJackThis...

The experts only work with the current version. So if you make a post with an older version, you'll simply be advised to get the latest version, re-run it, and re-post your log.

b) BAD: using a TEMP directory or your DESKTOP for HJT....

Some experts may insist you move HJT before they'll begin working with you. Others will start the repair process, advising you to move HJT as one of the very first steps. Failure to do so can result in losing potentially critical information. So please, just use the suggested C:\HJT directory, rather than try to be creative.

c) BAD: posting your log in the wrong forum...

if you post your log back here, in the Virus/SpyWare forum, it will "sit idly", either until the forum moderator gets around to move it for you... or until you decide to repost your log... in the HiJackThis forum.

indiz_fynest · Answer

i jus have a question, after posting my hijackthis log, i just want to know, what exactly will the experts do with it? how will they fix it? thanks for all the help.

ky331 · Answer

the HiJackLog will reveal everything that's currently running --- i.e., all the "hidden" background processes ---- as well as everything that automatically runs everytime you boot-up your system. this will allow them to determine whether or not you indeed have a CWS / about:blank infection... if so, they can tell you how to proceed to try to fix the problem (which often involves a combination of HiJackThis, CWShredder, and/or About:Buster). Unfortunately, without going through a HijackLog, I can't simply advise you to run these tools, as 1) it's possible you have a different cause for your Dr. Watson problem, and 2) one of the 'meaner' features of about:blank (especially when reinforced by trojans) is that it continually alters the file names it uses to attack your system:smileysad: which is why you need the HiJackLog to get into the 'guts' of your particular problem.

be advised that you may need a bit of patience... first, to wait for one of the experts to reply there... and then, to work things out with them, until the problem is completely fixed. if you happen to be lucky, they may be able to fix things entirely within 1 or 2 "cross-communications" with you. unfortunately, however, there have been incidences when the back-and-forth communication has gone on for days --- even weeks --- until the problem if finally conquered. but if you're willing to stick it out, the results there have been VERY good. so i strongly suggest you at least give it a shot.

Message Edited by ky331 on 07-13-2005 06:04 PM

Virus & Spyware

DrWatson Postmortem Debugger virus is ravaging my computer!! HELP ME!!

Was this post helpful?